- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 62, Issue 5
by Marilson 05 Jan '17

05 Jan '17

Suresh, The Anti-Spam Man. According Suresh, spam is basically transference of cost. It transfers the costs to others who haven't asked for it: the spammers' ISPs, the recipients' ISPs, the recipients. As you can see Andre, who qualifies the highest profit of ISPs (260 billion spam and scam per day) as being a cost transfer from the spammer to the ISP, has to be considered with caution. David Conrad - Chief Technology Officer - ICANN staff. His team developed one the first TCP/IP packages for the original IBM PC, Director General of APNIC, Nominum Inc, CloudFlare, performing roles at ICANN and general manager of the IANA. A expert with a remarkable curriculum. :) But Andre, he is doing what he is paid to do - to defend what he has created. So Andre, in an anti-spam wg, you cannot take seriously criticism about your correct anti-conformism with the lack of good ethics of this rotten and dishonest system they created. The offenses like "messianic complex" only indicate the fear they have of making public the illegal activity of the system. As wrote Simon, they will just have to agree to disagree. Are the foxes caring the henhouse. Until Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Wednesday, January 04, 2017 9:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 62, Issue 5 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (ox) 2. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (Rob Evans) 3. Re: DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity (ox) ---------------------------------------------------------------------- Message: 1 Date: Wed, 4 Jan 2017 09:16:02 +0200 From: ox <andre(a)ox.co.za> To: David Conrad <drc(a)virtualized.org> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <mailman.4.1483527602.30829.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII On Tue, 3 Jan 2017 23:05:07 -0800 David Conrad <drc(a)virtualized.org> wrote: > Andre, > On Jan 3, 2017, at 10:43 PM, ox <andre(a)ox.co.za> wrote: > >> On Jan 3, 2017, at 9:57 PM, ox <andre(a)ox.co.za> wrote: > >>> When respected Internet Engineers and organizations develop > >>> standards for Internet software that completely ignores ethics, > >>> morality, honesty and is pale and anemic in the truth department? > >> > >> You've developed quite the messianic complex here. > >> > > You do not say why this is not true. or not factual. or not correct. > > Because empirically, Internet Engineers (whoever they may be) and > organizations document protocols and bit patterns expressed across > wires. These protocols are tools that are neutral in terms of ethics, > morality, and honesty. How those tools are used and by whom is what > results in whether that are ethical, moral, or honest. You are > blaming the tool for the (presumed) failings of it users. > However, in this context, you presume to know The Truth. Such > certainty must be quite reassuring. > Your comments in your entire reply, is the same. Let me place your own argument, in context, for yourself: Your argument is that someone making a nuclear weapon is not responsible for the use of a nuclear weapon. Yes, I do know my truth. I know my own ethics. I know my own morality. I know myself. I know right from wrong, if you want to make this about my own ethics. I would venture that I am not alone in my understanding of what is good and what is evil. Let me try to help you with that, as you seem to have a real problem: It is always wrong to lie. it is wrong to hide the truth of your lies (deception/falsehood) It is EVIL to declare that as "normal" behavior It is EVIL to support lies, falsehoods and suppression of knowledge. hth Andre > >> Yow. RPZ is a tool. You don't like that tool? Don't use it. You > >> care about the "truth"? Do your own DNSSEC validation. > > Sure, there are many tools, hacker tools, 0day scripts (for kidd1eS) > > If you cannot tell the difference between a tool I choose to deploy > to protect myself and the users I am responsible for (who can also > opt out if they so choose) and a tool that allows me to attack > external users, I doubt continued discussion is worthwhile. > > > Why do you not discuss the real issues? > > As far as I can tell, you have not identified any real issue, either > here or on DNSOP. You have, like religious preachers, declared your > view on ethics, morality, honesty, and truth, as axiomatic but not > discussed real issues that affect the development of tools to help > reduce abuse (relevant to this list) or the implementation of the > protocol (relevant to DNSOP). When you do so, perhaps then there > might be a discussion. > > > The truth is: I do not have a messianic complex > > It appears the truth is you believe you know The Truth. > > > The truth is, very obviously, you do not care about the truth :) > > If you say so, it must be true. > > Regards, > -drc > (speaking only for myself) > > ------------------------------ Message: 2 Date: Wed, 4 Jan 2017 09:31:37 +0000 From: Rob Evans <rhe(a)nosc.ja.net> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <6bd5d9a3-c1ab-75cd-f2d3-783684a17b3e(a)nosc.ja.net> Content-Type: text/plain; charset=windows-1252; format=flowed Hi, >> The presumed draft you're unhappy about >> (https://datatracker.ietf.org/doc/draft-vixie-dns-rpz/) is >> informational. It is not a standard. >> > not yet a standard. operational word, I guess, is yet. so there is > still time to create awareness and to speak out. More than that, it hasn't yet been adopted by the dnsop working group in the IETF, where a similar discussion is happening, and I don't believe the authors have stated an aim for an individual submission RFC. Raising awareness of RPZ is good, however it's an operational tool that many service providers and enterprises might want in their arsenal (even if as an opt-in). The best place to discuss furthering (or otherwise) RPZ is likely to be on the IETF's dnsop list. Cheers, Rob ------------------------------ Message: 3 Date: Wed, 4 Jan 2017 12:26:02 +0200 From: ox <andre(a)ox.co.za> To: Rob Evans <rhe(a)nosc.ja.net> Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity Message-ID: <mailman.5.1483527602.30829.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII On Wed, 4 Jan 2017 09:31:37 +0000 Rob Evans <rhe(a)nosc.ja.net> wrote: > >> The presumed draft you're unhappy about > >> (https://datatracker.ietf.org/doc/draft-vixie-dns-rpz/) is > >> informational. It is not a standard. > > not yet a standard. operational word, I guess, is yet. so there is > > still time to create awareness and to speak out. > More than that, it hasn't yet been adopted by the dnsop working group > in the IETF, where a similar discussion is happening, and I don't > believe the authors have stated an aim for an individual submission > RFC. > Raising awareness of RPZ is good, however it's an operational tool > that many service providers and enterprises might want in their > arsenal (even if as an opt-in). > This is also maybe a good discussion to have in an abuse wg on a different thread:Why "DNS Firewalls" and RPZ is the wrong abuse tool to use or why it is a "good tool" for providers and enterprises to use. Whether "walled off Internet gardens" is a good thing for abuse and how that balances out with freedom, openness and the other pesky problems. About this thread though, it is very important that any inkling of this becoming an RFC needs to generate much more interest and involvement than DNS ops. Judging from where RPZ is at now: Adding DECEPTION to LIES, and producing different lies depending on which user is asking the questions, is patently and clearly not good. Arguments that we need to become killers because there are killers is simply not in the best interests of a free and open society. DNS ops quite obviously cannot be objective, AND they cannot be left alone with this issue. It is clear where this laissez-faire re RPZ has led and produced over the past 7? years! And abuse admins will be directly impacted by the adoption of this as a standard. > The best place to discuss furthering (or otherwise) RPZ is likely to > be on the IETF's dnsop list. > Not really. (and I have already done that anyway) It is the DNS Op's whom are in need of protection against themselves. As I said above, the drift over the past years has been to use non ethical, dishonest methods (and now also to even use deception and hide their lies) - Non acceptable and the abuse admins and others need to become involved as the situation is not fixing itself. It is the entire methodology and flawed foundation of the entire RPZ protocol that is in question. if you build a house foundation in clay, your walls will crack. If the majority here agrees that RPZ is evil, then we may start discussing why DNS is better used as a reactive abuse tool and poorly suited to "firewall" use and that it is completely wrong to promote a method that involves promoting dishonesty. If the majority does not agree that RPZ is evil, as you seem not to yourself? then we still need to discuss the WHY you think it is not evil and why you think it is a good idea to tell different lies to different users and to hide the truth from your own users, etc etc Andre End of anti-abuse-wg Digest, Vol 62, Issue 5 ********************************************

3 2

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by David Conrad 04 Jan '17

04 Jan '17

Andre, On Jan 3, 2017, at 9:57 PM, ox <andre(a)ox.co.za> wrote: > When respected Internet Engineers and organizations develop standards > for Internet software that completely ignores ethics, morality, > honesty and is pale and anemic in the truth department? You've developed quite the messianic complex here. > I strongly object to RPZ being peddled as a "standard" by the Internet Community. The presumed draft you're unhappy about (https://datatracker.ietf.org/doc/draft-vixie-dns-rpz/) is informational. It is not a standard. > RPZ will destroy the Internet - people are lazy (i am lazy also) Actually, it is the people who do stuff that makes RPZ a solution that are destroying the Internet. RPZ is a hack that some folks find useful in addressing particular forms of abuse, nothing more. > Quite obviously we, as an Internet Community, already no longer cares > much about the truth of something, which is also why we live in a > post-truth planet. Yow. RPZ is a tool. You don't like that tool? Don't use it. You care about the "truth"? Do your own DNSSEC validation. Personally, I'd prefer a world where there are fewer tools that are well described, even if some times those tools may be used in ways that I don't agree with, than in a world of a myriad of tools, poorly described, all trying to solve the same problem (using a solution I may not agree with), doing it in ways that are incompatible. Or do you think that by refusing to document something that it magically goes away? Regards, -drc (speaking only for myself)

3 3

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by David Conrad 04 Jan '17

04 Jan '17

Andre, On Jan 3, 2017, at 10:43 PM, ox <andre(a)ox.co.za> wrote: >> On Jan 3, 2017, at 9:57 PM, ox <andre(a)ox.co.za> wrote: >>> When respected Internet Engineers and organizations develop >>> standards for Internet software that completely ignores ethics, >>> morality, honesty and is pale and anemic in the truth department? >> >> You've developed quite the messianic complex here. >> > You do not say why this is not true. or not factual. or not correct. Because empirically, Internet Engineers (whoever they may be) and organizations document protocols and bit patterns expressed across wires. These protocols are tools that are neutral in terms of ethics, morality, and honesty. How those tools are used and by whom is what results in whether that are ethical, moral, or honest. You are blaming the tool for the (presumed) failings of it users. However, in this context, you presume to know The Truth. Such certainty must be quite reassuring. >> Yow. RPZ is a tool. You don't like that tool? Don't use it. You care >> about the "truth"? Do your own DNSSEC validation. > Sure, there are many tools, hacker tools, 0day scripts (for kidd1eS) If you cannot tell the difference between a tool I choose to deploy to protect myself and the users I am responsible for (who can also opt out if they so choose) and a tool that allows me to attack external users, I doubt continued discussion is worthwhile. > Why do you not discuss the real issues? As far as I can tell, you have not identified any real issue, either here or on DNSOP. You have, like religious preachers, declared your view on ethics, morality, honesty, and truth, as axiomatic but not discussed real issues that affect the development of tools to help reduce abuse (relevant to this list) or the implementation of the protocol (relevant to DNSOP). When you do so, perhaps then there might be a discussion. > The truth is: I do not have a messianic complex It appears the truth is you believe you know The Truth. > The truth is, very obviously, you do not care about the truth :) If you say so, it must be true. Regards, -drc (speaking only for myself)

2 1

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by Suresh Ramasubramanian 04 Jan '17

04 Jan '17

Yes – I can clearly see that in this screed, post truth, facts not mattering as long as there is spin and such. You are bashing tech when you should be targeting its misuse. --srs On 04/01/17, 10:30 AM, "ox" <andre(a)ox.co.za> wrote: Hello Suresh, Whether this wg makes any difference, or not, is completely up to each and every one of us. It is Simon's choice to simply say that the fact that the Internet Standards promote fraud, is "my position" We live in a post-truth era. Facts do not matter so much anymore if the spin is good.

2 1

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by Simon Forster 04 Jan '17

04 Jan '17

Andre Your rhetoric makes it quite clear that you have taken a position and will stick to it. That’s fine. We’ll just have to agree to disagree. All the best Simon > On 3 Jan 2017, at 10:30, ox <andre(a)ox.co.za> wrote: > > On Tue, 3 Jan 2017 10:07:36 +0000 > Simon Forster <simon-lists(a)ldml.com> wrote: >> Hello Andre >> > Hello Simon, > >> An interesting take on a mechanism that’s been available for close to >> 7 years now > > And, from the first DNS servers there has been people that has resolved > example.com to whatever IP they choose... so what? > > Many large ISP's resolve sadfgsdjfgn4563456346.com to their own home > page (or a "register this domain") page -- even though whatever > question was asked - is not registered at all. > > When it becomes a "STANDARD" (ACCEPTABLE) and nefarious behavior is > suddenly "the way things work" - then this is of serious concern. > > Your reply, in a nutshell is: "This is the way things work, there is > nothing wrong with it and if you do not like it setup your own > resolvers" > > My objections are easy: Defining a clear standard on how DNS tells lies > to users, and different lies to different users, depending on which > user is doing the asking, and then hiding the truth of your lies from > your users, is EVIL! > > Allowing the easy management of "private Internet" in as a standard, is > EVIL > > RPZ is the start of the end of the open and free Internet. > >> Largely I believe you’re on the wrong track with your post — at >> pretty much every level. Response Policy Zones (RPZ’s aka DNS >> firewalls) are a powerful tool to allow individuals, organisations or >> society better to control access to the darker corners of the >> internet. As per Vixie’s original paper (see above reference), this >> can circumvent a lot of harm for the average user. >> > > as I said: trillions of domain names can resolve to ONE ip number. > > a "DNS firewall" is a silly technical argument against abuse. > > What is of concern is "private" internets and this "standard" allowing > easy management of lies - and then doing it in the dark, so that users > have no way of knowing that they are being lied to (or "protected") > >> As with any powerful tool, it can be used with ill intent but >> overall, this is a useful addition to an organisation’s security >> arsenal. >> > > Distributing hacker and cracker tools is also fine, I guess. But it is > very wrong to define actual standards for how to break into servers and > networks. - And making that a standard. > >> You express concerns wrt governments. Governments have a tendency to >> do what what they want to do irrespective of the tools available to >> them — after all, compliance with their rules is not their problem, >> they just need to prosecute those that fail to follow the new rules. >> > Also, it allows and empowers dictators (AND CRIMINALS) - and now the > dictators can say: This is a "standard" the Internet community accepts > that this is the methods and protocols for "protecting" my "users" > > Yes, Governments do what they want - but defining a standard on how to > tell lies and in such a way that your "users" do not know if they are > being lied to - is nefarious and evil. > > Your objection to my allegations are quite suspect as you have not > mentioned one single technical reason why making this EVIL method of > operation is not abuse? > >> Irrespective of any philosophical objections you’re throwing out >> here, the resolution to your problem is incredibly simple — run your >> own recursive resolver. In this day and age an incredibly simple >> thing to do (which is another, markedly different problem). >> > > Sure, and run my own Internet? > > This is exactly the point. > >> >>> On 2 Jan 2017, at 06:48, ox <andre(a)ox.co.za> wrote: >>> Hello, >>> >>> I wish everyone a prosperous & productive 2017 >>> >>> I wish to cast light on an abuse issue that has the potential to >>> effect, affect and impact the entire Internet >>> As among the proponents of this abuse are certain Government >>> Security Agencies and many other powerful forces, I beg with you to >>> attempt to understand how the changes being effected right now, also >>> affects yourself right now and how it will affect you in the >>> future. >>> My idea with this post is three fold, firstly, to educate, secondly >>> to open discussion and thirdly to agitate for change. >>> DNS Abuse >>> ---------------- >>> Sometimes abuse is creeping, like weed in a garden it becomes more >>> and more and more and does not just happen overnight. In fact, it is >>> so creeping that we do not really see the weeds as we have become >>> used to seeing them. >>> >>> Just because there are so many weeds, it does not change the fact >>> that they are weeds and, in a well maintained garden, they need to >>> be eradicated for the well being of all the plants in the garden. >>> >>> To understand how this is even abuse, and how this will change your >>> own life and the Internet in the future, you need to also understand >>> some basic facts. The arguments for, against the standards, the >>> basic tech concepts, the functional aspects and then understand why >>> this is actually abuse and not just an evil movement, evil >>> standards or generally just plain old evil. >>> >>> Some important concepts in order to understand the technical logic >>> and the "explained purpose" and then, importantly, "the real >>> purpose" of the abusers: >>> >>> Trillions of domain names can resolve to a single ipv4 ip number >>> So, you could have ex.example.com and ex1.example.com and >>> cat.example.com - and have the same for unlimited names from >>> unlimited TLD to a SINGLE ip number. >>> >>> All Domain names are intellectual property - yes, even >>> abc.dsrtif.dsaurthp.example.com >>> >>> If a DNS server is asked for an IP number for google.com and it >>> answers 127.0.0.1 to one user and 0.0.0.0 to a different user >>> (makes up its own answers) - This is simply fraud. as google.com >>> is a trademark. >>> (replace google.com with apple.com or ibm.com facebook.com or >>> any.example.com) >>> >>> The proponents of DNS abuse argue that they are 'protecting' >>> innocent users by using DNS as a 'firewall' to create 'walled >>> gardens' and to respond to one ip number for a certain set of users >>> and a different ip number for different sets of users >>> >>> Of course, this argument is fatally flawed as per my example above. >>> Their response is that there is sometimes multi homed ip numbers >>> (100 domains on a single ip number) and that blocking per ip number >>> blocks innocent domains as well. >>> >>> In order for you to form your own opinion you need to know that the >>> majority of DNS servers use the same software and that there are new >>> standards being introduced to formalize Internet Fraud. This >>> Internet Fraud empowers African Dictators to easily justify 'walled >>> garden' countries and is set to revolutionize your own Internet >>> access. It also empowers, facilitates and allows easy management >>> to aggressive ISP's, multi nationals and many nefarious groups and >>> people to manage their activities. So, not only does the new >>> software 'functionality' exist, but it is being legitimized and >>> formalized by https://www.ietf.org/ >>> (whom, ironically, states:The goal of the IETF is to make the >>> Internet work better.) >>> >>> In a nutshell, the above illustrates that the DNS software used by >>> almost all of the Internet is to have functionality that allows DNS >>> operators to LIE to users, but to lie one lie to some/certain users >>> and another LIE to different sets of users (depending on whom is >>> doing the asking) >>> >>> That is not all... >>> >>> It also allows the DNS operators to hide the truth of these lies... >>> >>> and that is not all... >>> >>> The https://www.ietf.org/ is set to legitimize this nefarious >>> behavior under the flag of decency and good Internet operations. >>> >>> So, it would be perfectly fine and acceptable for everyone to start >>> doing this, as it will be a 'standard' >>> >>> What this means for you: The future Internet will not be free and >>> open. >>> >>> Engineers supporting a non functional and fatally flawed approach to >>> abuse is an indication of a far more serious problem - you need to >>> think about that for yourself, and what that means. >>> >>> Of course, this in itself is abuse. This entire situation is >>> Internet Abuse and needs to be discussed as abuse. >>> >>> Andre >>> >>> -- >>> more technical information: >>> https://tools.ietf.org/html/draft-vixie-dns-rpz-00

3 2

Re: [anti-abuse-wg] DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by Simon Forster 03 Jan '17

03 Jan '17

Hello Andre An interesting take on a mechanism that’s been available for close to 7 years now <http://www.circleid.com/posts/20100728_taking_back_the_dns/ <http://www.circleid.com/posts/20100728_taking_back_the_dns/>>. Largely I believe you’re on the wrong track with your post — at pretty much every level. Response Policy Zones (RPZ’s aka DNS firewalls) are a powerful tool to allow individuals, organisations or society better to control access to the darker corners of the internet. As per Vixie’s original paper (see above reference), this can circumvent a lot of harm for the average user. As with any powerful tool, it can be used with ill intent but overall, this is a useful addition to an organisation’s security arsenal. You express concerns wrt governments. Governments have a tendency to do what what they want to do irrespective of the tools available to them — after all, compliance with their rules is not their problem, they just need to prosecute those that fail to follow the new rules. Irrespective of any philosophical objections you’re throwing out here, the resolution to your problem is incredibly simple — run your own recursive resolver. In this day and age an incredibly simple thing to do (which is another, markedly different problem). Simon > On 2 Jan 2017, at 06:48, ox <andre(a)ox.co.za> wrote: > > Hello, > > I wish everyone a prosperous & productive 2017 > > I wish to cast light on an abuse issue that has the potential to > effect, affect and impact the entire Internet > > As among the proponents of this abuse are certain Government > Security Agencies and many other powerful forces, I beg with you to > attempt to understand how the changes being effected right now, also > affects yourself right now and how it will affect you in the future. > > My idea with this post is three fold, firstly, to educate, secondly to > open discussion and thirdly to agitate for change. > > DNS Abuse > ---------------- > Sometimes abuse is creeping, like weed in a garden it becomes more > and more and more and does not just happen overnight. In fact, it is > so creeping that we do not really see the weeds as we have become > used to seeing them. > > Just because there are so many weeds, it does not change the fact > that they are weeds and, in a well maintained garden, they need to be > eradicated for the well being of all the plants in the garden. > > To understand how this is even abuse, and how this will change your > own life and the Internet in the future, you need to also understand > some basic facts. The arguments for, against the standards, the basic > tech concepts, the functional aspects and then understand why this is > actually abuse and not just an evil movement, evil standards or > generally just plain old evil. > > Some important concepts in order to understand the technical logic and > the "explained purpose" and then, importantly, "the real purpose" of the > abusers: > > Trillions of domain names can resolve to a single ipv4 ip number > So, you could have ex.example.com and ex1.example.com and > cat.example.com - and have the same for unlimited names from unlimited > TLD to a SINGLE ip number. > > All Domain names are intellectual property - yes, even > abc.dsrtif.dsaurthp.example.com > > If a DNS server is asked for an IP number for google.com and it > answers 127.0.0.1 to one user and 0.0.0.0 to a different user (makes > up its own answers) - This is simply fraud. as google.com is a > trademark. > (replace google.com with apple.com or ibm.com facebook.com or > any.example.com) > > The proponents of DNS abuse argue that they are 'protecting' innocent > users by using DNS as a 'firewall' to create 'walled gardens' and to > respond to one ip number for a certain set of users and a different ip > number for different sets of users > > Of course, this argument is fatally flawed as per my example above. > Their response is that there is sometimes multi homed ip numbers (100 > domains on a single ip number) and that blocking per ip number blocks > innocent domains as well. > > In order for you to form your own opinion you need to know that the > majority of DNS servers use the same software and that there are new > standards being introduced to formalize Internet Fraud. This Internet > Fraud empowers African Dictators to easily justify 'walled garden' > countries and is set to revolutionize your own Internet access. It also > empowers, facilitates and allows easy management to aggressive > ISP's, multi nationals and many nefarious groups and people to manage > their activities. So, not only does the new software 'functionality' > exist, but it is being legitimized and formalized > by https://www.ietf.org/ > (whom, ironically, states:The goal of the IETF is to make the Internet > work better.) > > In a nutshell, the above illustrates that the DNS software used by > almost all of the Internet is to have functionality that allows DNS > operators to LIE to users, but to lie one lie to some/certain users and > another LIE to different sets of users (depending on whom is doing the > asking) > > That is not all... > > It also allows the DNS operators to hide the truth of these lies... > > and that is not all... > > The https://www.ietf.org/ is set to legitimize this nefarious behavior > under the flag of decency and good Internet operations. > > So, it would be perfectly fine and acceptable for everyone to start > doing this, as it will be a 'standard' > > What this means for you: The future Internet will not be free and open. > > Engineers supporting a non functional and fatally flawed approach to > abuse is an indication of a far more serious problem - you need to > think about that for yourself, and what that means. > > Of course, this in itself is abuse. This entire situation is Internet > Abuse and needs to be discussed as abuse. > > Andre > > -- > more technical information: > https://tools.ietf.org/html/draft-vixie-dns-rpz-00 > > > > > > > > > > > >

2 1

DNS Abuse, Abuse of Privacy & Legitimizing Criminal Activity
by ox 02 Jan '17

02 Jan '17

Hello, I wish everyone a prosperous & productive 2017 I wish to cast light on an abuse issue that has the potential to effect, affect and impact the entire Internet As among the proponents of this abuse are certain Government Security Agencies and many other powerful forces, I beg with you to attempt to understand how the changes being effected right now, also affects yourself right now and how it will affect you in the future. My idea with this post is three fold, firstly, to educate, secondly to open discussion and thirdly to agitate for change. DNS Abuse ---------------- Sometimes abuse is creeping, like weed in a garden it becomes more and more and more and does not just happen overnight. In fact, it is so creeping that we do not really see the weeds as we have become used to seeing them. Just because there are so many weeds, it does not change the fact that they are weeds and, in a well maintained garden, they need to be eradicated for the well being of all the plants in the garden. To understand how this is even abuse, and how this will change your own life and the Internet in the future, you need to also understand some basic facts. The arguments for, against the standards, the basic tech concepts, the functional aspects and then understand why this is actually abuse and not just an evil movement, evil standards or generally just plain old evil. Some important concepts in order to understand the technical logic and the "explained purpose" and then, importantly, "the real purpose" of the abusers: Trillions of domain names can resolve to a single ipv4 ip number So, you could have ex.example.com and ex1.example.com and cat.example.com - and have the same for unlimited names from unlimited TLD to a SINGLE ip number. All Domain names are intellectual property - yes, even abc.dsrtif.dsaurthp.example.com If a DNS server is asked for an IP number for google.com and it answers 127.0.0.1 to one user and 0.0.0.0 to a different user (makes up its own answers) - This is simply fraud. as google.com is a trademark. (replace google.com with apple.com or ibm.com facebook.com or any.example.com) The proponents of DNS abuse argue that they are 'protecting' innocent users by using DNS as a 'firewall' to create 'walled gardens' and to respond to one ip number for a certain set of users and a different ip number for different sets of users Of course, this argument is fatally flawed as per my example above. Their response is that there is sometimes multi homed ip numbers (100 domains on a single ip number) and that blocking per ip number blocks innocent domains as well. In order for you to form your own opinion you need to know that the majority of DNS servers use the same software and that there are new standards being introduced to formalize Internet Fraud. This Internet Fraud empowers African Dictators to easily justify 'walled garden' countries and is set to revolutionize your own Internet access. It also empowers, facilitates and allows easy management to aggressive ISP's, multi nationals and many nefarious groups and people to manage their activities. So, not only does the new software 'functionality' exist, but it is being legitimized and formalized by https://www.ietf.org/ (whom, ironically, states:The goal of the IETF is to make the Internet work better.) In a nutshell, the above illustrates that the DNS software used by almost all of the Internet is to have functionality that allows DNS operators to LIE to users, but to lie one lie to some/certain users and another LIE to different sets of users (depending on whom is doing the asking) That is not all... It also allows the DNS operators to hide the truth of these lies... and that is not all... The https://www.ietf.org/ is set to legitimize this nefarious behavior under the flag of decency and good Internet operations. So, it would be perfectly fine and acceptable for everyone to start doing this, as it will be a 'standard' What this means for you: The future Internet will not be free and open. Engineers supporting a non functional and fatally flawed approach to abuse is an indication of a far more serious problem - you need to think about that for yourself, and what that means. Of course, this in itself is abuse. This entire situation is Internet Abuse and needs to be discussed as abuse. Andre -- more technical information: https://tools.ietf.org/html/draft-vixie-dns-rpz-00

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 61, Issue 6
by Marilson 21 Nov '16

21 Nov '16

Peter, You are being the victim of a swindler. He is passing himself off as a well-known lawyer, Mark J. Silberman, to take your money. If you make contact - munged (at) gmail.com - you will know how he acts. Report to antispam_gdnoc(a)189.cn. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Sunday, November 20, 2016 9:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 61, Issue 6 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: New on RIPE Labs: Reasons Dynamic Addresses Change (Ramakrishna) 2. What's the point in this type of spam ? (peter h) 3. Re: What's the point in this type of spam ? (ox) ---------------------------------------------------------------------- Message: 1 Date: Sat, 19 Nov 2016 06:41:43 -0800 From: Ramakrishna <ramapad(a)cs.umd.edu> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] New on RIPE Labs: Reasons Dynamic Addresses Change Message-ID: <CAAYmKkJ3DjUf7bd9pUktFwr8QjV3QtNAWMF41VzTeFbqskE4kQ(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" > ok... so first of all the address changes within DTAG and most other german SOHO DSL providers, from what i heard back then, goes back to the days of dialup... a couple of years ago they apparently still were forced by law (or something) to also offer DSL on a 'charge per time use' basis, and also disconnect virtual channels every once in a while, something to do with anti-competition to the telephone dialup network.. which apparently is why most german dsl providers still do that. Ah, thanks for providing the historical context for why German DSL providers change addresses so frequently. I am skeptical, however, that there is a law requiring German DSL providers to disconnect virtual channels 'every once in a while' because I asked several German colleagues about such a law and they were unable to find one (I would be delighted if you can point me to one!). > secondly... if your authentication and telling users apart has anything to do with layer 3, your authentication method is just crap, not well thought of, etc. There are other use-cases for IP addresses as end-host identifiers that I outlined in my post (such as counting the number of users in a system by counting the number of distinct IP addresses). I am personally interested in measuring outages by pinging IP addresses belonging to residential CPEs. My premise for detecting outages is that an address that sends responses to active probes is alive and well, and that a previously responsive address that has stopped responding to probes could be experiencing an outage. This premise is incorrect when I am pinging a dynamic address that has been withdrawn from the CPE; thus, I would love to analyze dynamic reassignment behavior across ISPs. I agree that using IP addresses for identifying users for authentication purposes isn't ideal but sometimes, IP addresses are the easiest way to identify users. Other times, they are the only ways to identify users. For example, if one is defending against a DoS attack, the most straightforward and efficient approach is to blacklist that IP address temporarily. How long that address can continue to remain in the blacklist is the question that we aim to answer. > as for wikipedia, it also leaks ips all over the place. (basically inciting users to ddos each other,although probably a less common result than with IRC.) Well, wikipedia is only one example of a well-known company that employs IP address based blacklists. In private conversation with Google and several content-delivery networks (including one where I interned earlier this year), I learned that IP addresses are very much a part of host-reputation systems. So although IP addresses as end-hosts isn't ideal, it's a common assumption and our work shows that the assumption can actually even be valid for weeks at a time in North American ISPs. Cheers, Rama http://www.cs.umd.edu/~ramapad/

1 0

What's the point in this type of spam ?
by peter h 20 Nov '16

20 Nov '16

The last days i have been sent a number of these threats, they come from different addresses ( stolen computers ) but contain no links or attatchements. Is the goal to harass the gmail user ( it's munged by me to protect an innocent person ) Received: from 14.145.207.224 ([113.68.244.108]) by ipsec.se (8.13.6/8.13.6) with SMTP id uAILTOwC091474 for <peter(a)ipsec.nu>; Fri, 18 Nov 2016 22:29:32 +0100 (CET) Message-Id: <201611182129.uAILTOwC091474(a)ipsec.se> Received: from unknown (HELO localhost) (mark.silberman78@gmail.com@177.205.66.120) by 113.68.244.108 with ESMTPA; Sat, 19 Nov 2016 05:29:22 +0800 From: m-**-.-munged-78(a)gmail.com To: peter(a)ipsec.nu Subject: You are hacked! Date: Sat, 19 Nov 2016 05:21:56 +0800 Content-Type: X-UID: 5404 X-Length: 910 Your email peter(a)ipsec.nu has been hacked and spam is sent to all your contacts! If you don't have a lawyer, you may contact me at <munged>@gmail.com Best Regards, M**- m**-.-munged-78(a)gmail.com -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

2 1

Re: [anti-abuse-wg] New on RIPE Labs: Reasons Dynamic Addresses Change
by Ramakrishna 19 Nov '16

19 Nov '16

> ok... so first of all the address changes within DTAG and most other german SOHO DSL providers, from what i heard back then, goes back to the days of dialup... a couple of years ago they apparently still were forced by law (or something) to also offer DSL on a 'charge per time use' basis, and also disconnect virtual channels every once in a while, something to do with anti-competition to the telephone dialup network.. which apparently is why most german dsl providers still do that. Ah, thanks for providing the historical context for why German DSL providers change addresses so frequently. I am skeptical, however, that there is a law requiring German DSL providers to disconnect virtual channels 'every once in a while' because I asked several German colleagues about such a law and they were unable to find one (I would be delighted if you can point me to one!). > secondly... if your authentication and telling users apart has anything to do with layer 3, your authentication method is just crap, not well thought of, etc. There are other use-cases for IP addresses as end-host identifiers that I outlined in my post (such as counting the number of users in a system by counting the number of distinct IP addresses). I am personally interested in measuring outages by pinging IP addresses belonging to residential CPEs. My premise for detecting outages is that an address that sends responses to active probes is alive and well, and that a previously responsive address that has stopped responding to probes could be experiencing an outage. This premise is incorrect when I am pinging a dynamic address that has been withdrawn from the CPE; thus, I would love to analyze dynamic reassignment behavior across ISPs. I agree that using IP addresses for identifying users for authentication purposes isn't ideal but sometimes, IP addresses are the easiest way to identify users. Other times, they are the only ways to identify users. For example, if one is defending against a DoS attack, the most straightforward and efficient approach is to blacklist that IP address temporarily. How long that address can continue to remain in the blacklist is the question that we aim to answer. > as for wikipedia, it also leaks ips all over the place. (basically inciting users to ddos each other,although probably a less common result than with IRC.) Well, wikipedia is only one example of a well-known company that employs IP address based blacklists. In private conversation with Google and several content-delivery networks (including one where I interned earlier this year), I learned that IP addresses are very much a part of host-reputation systems. So although IP addresses as end-hosts isn't ideal, it's a common assumption and our work shows that the assumption can actually even be valid for weeks at a time in North American ISPs. Cheers, Rama http://www.cs.umd.edu/~ramapad/

1 0